high8.1
CVE-2020-1757
Improper Input Validation in Undertow
Impact
A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.undertow:undertow-core | <= 2.0.42 | 2.1.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Undertow | before 2.1.0 Versions 2.0.0, 2.0.25, 2.0.26, 2.0.28 |
| Redhat | Jboss Data Grid | Version 7.0.0 |
| Redhat | Jboss Enterprise Application Platform | Version 7.0.0 |
| Redhat | Jboss Fuse | Versions 6.0.0, 7.0.0 |
| Redhat | Openshift Application Runtimes | All versions |
| Redhat | Single Sign-On | Version 7.0 |